⬢ DragonFlyBSD Kernel Audit
DF-0232 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c
--- a/sys/kern/sys_socket.c
+++ b/sys/kern/sys_socket.c
@@ -161,7 +161,13 @@
 		error = 0;
 		break;
 	case SIOCSPGRP:
-		error = fsetown(-(*(int *)data), &so->so_sigio);
+	{
+		int _pgid = *(int *)data;
+		if (_pgid == (int)0x80000000	/* INT_MIN: -_pgid would overflow */)
+			error = EINVAL;
+		else
+			error = fsetown(-_pgid, &so->so_sigio);
+	}
 		break;
 	case SIOCGPGRP:
 		*(int *)data = -fgetown(&so->so_sigio);
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -1029,7 +1029,13 @@
 		break;
 	case TIOCSPGRP:
 		/* This is deprecated, FIOSETOWN should be used instead. */
-		error = fsetown(-(*(int *)data), &rpb->sigio);
+	{
+		int _pgid = *(int *)data;
+		if (_pgid == (int)0x80000000	/* INT_MIN: -_pgid would overflow */)
+			error = EINVAL;
+		else
+			error = fsetown(-_pgid, &rpb->sigio);
+	}
 		break;
 
 	case TIOCGPGRP: